OpenSSL v3.0.x Buffer Overrun Vulnerability

02 Nov / 2022

Cyber Security

CVE-2022-3602 – OpenSSL v3.0.x Buffer Overrun Vulnerability


CVE: CVE-2022-3602 and CVE-2022-3786
What Is Vulnerable?: OpenSSL versions 3.0.0 or later. It is worth noting that SSL v3.0.0 was released in September 2021.

What’s Happening?

October 26th, the OpenSSL project team announced a critical vulnerability that was found in their widely used TLS and SSL software library. An additional statement from the OpenSSL team on the 1st of November downgraded the vulnerability from critical to high, citing that testing feedback provided by security firms. Estimates from shodan.io, indicate that 16,000 of all websites using OpenSSL are currently using version 3.0.x or later. Currently, there is no known exploitation of these vulnerabilities in the wild. OpenSSL prior to v3.0.x are not vulnerable as the exploit is due to a decoding functionality which was introduced in v3.0.x.

Key Facts

  • This vulnerability can be a client/browser-based exploit via browsing to an attacker-controlled server presenting with a malicious certificate.
  • Alternatively, if an SSL server requests a certificate from the client, the client can provide a malicious certificate.
  • Could cause a local crash, remote code execution or unexpected behaviour.
  • Browsers are unlikely to be using OpenSSL v.3.0.x due to slow adoption.
  • OpenSSL v3.0.x is installed by default in some new versions of Linux distributions.

What You Can Do

  • Cythera is monitoring EndpointProtect and Managed Detection and Response clients for associated indicators of attack and post exploitation activities.
  • Cythera Vulnerability Management clients are actively being scanned for any instances of vulnerable versions of OpenSSL.
  • Consult with vendors to ensure that their software has been patched.
  • Any instances of OpenSSL v3.0.x should be patched to v3.0.7 which has been released as of the 1st of November. The patch can be found here.

Resources

You may be interested in

How to build a robust cybersecurity penetration testing program.

In light of growing high-profile cyber security attacks in Australia, a number of organisations and enterprises are looking to improve their cyb…

Read More arrow_forward

The Ugly Side of ISO 27001 Compliance. What Happens if You Get it Wrong?

We’re going to be candid and frank here. ISO 27001 audits, and any cybersecurity compliance audits at all, can be hard to achieve and stressfu…

Read More arrow_forward

Why Cythera partners with CrowdStrike to help customers achieve ACSC’s Essential Eight Level 1

Developed by the Australian Signals Directorate (ASD), The Essential 8 (E8) is a prioritised list of mitigation strategies designed to help Aust…

Read More arrow_forward